Field Effect MDR
Field Effect MDR is a productized MDR service for SMEs, MSPs and lean IT teams that uses Field Effect's portal, endpoint agent, cloud integrations, network appliance options and 24/7 SOC. After an alert, Field Effect analysts triage and can contain threats through approved response policies, while the buyer or MSP still owns policy choices, recovery work, connected tools and out-of-scope incident response.
- Service
- Active MDR
- Response
- Contain threats
Best for
MSPs standardizing MDR across small-business clientsUsually replaces
Endpoint-only EDR monitoring for small and mid-market environmentsResponse role
Service can take or orchestrate containment actions within the approved scope.Check first
Choosing the Active Response policy and excluding critical systems where downtime risk mattersCoverage
Covers
- 24/7 SOC monitoring across Field Effect MDR telemetry
- Active Response policies for approved containment actions
- ARO workflow for actions, recommendations and observations
Your team still owns
- Deploying endpoint agents, cloud integrations, network appliances and partner PSA workflows
- Recovering systems, restoring service and handling business decisions after containment
- Verifying which package covers network, cloud apps, log retention and analyst support
Tradeoffs
Works well
- Active Response evidence supports containment, not only alert forwarding
- Per-user pricing can simplify quoting for MSPs and SMBs with multiple devices per user
- AROs combine vulnerability, endpoint, cloud and network findings in one workflow
Watch out for
- Full coverage depends on choosing the right package, especially for network and cloud-app monitoring
- Buyers get less raw telemetry control than they would with a self-operated SIEM
- Public pricing does not include dollar amounts despite the published per-user model
What customers say
G2, PeerSpot and SoftwareReviews users often describe Field Effect MDR as useful for MSPs and lean IT teams because AROs reduce noise and surface patch, endpoint or cloud-account issues. Repeated cautions include onboarding time, limited raw telemetry visibility, UI or SIEM limits and occasional installation or licensing issues.
Reported benefits
- Reviewers value AROs that highlight actionable endpoint, CVE and cloud-account issues
- MSP-oriented reviews mention PSA visibility and easier cross-client monitoring
- PeerSpot users repeatedly mention broad endpoint, network and cloud visibility
- Several reviews call out responsive support and analyst access
Reported limits
- G2 and PeerSpot reviews mention onboarding or environment-tuning time
- PeerSpot summaries include UI, SIEM capability, licensing and server installation caveats
- SoftwareReviews includes a complaint about limited log transparency behind an ARO
- Reddit discussion notes the tradeoff of abstracted backend telemetry
Pricing
- Price signal
- Quote-based per-user pricing
- Billing model
- Per-user, Tiered, Custom
Ask before buying
- Which package covers our endpoint, network, Microsoft 365, Google Workspace and other cloud-app telemetry?
- Which Active Response policy will be enabled after onboarding, and which actions require approval?
- Are extended log retention, daily dark web monitoring, security awareness training or an incident response retainer included?
Connects with
- EDR / Endpoint
- Field Effect Endpoint Agent
- Microsoft Defender Antivirus management
- Carbon Black
- Palo Alto Cortex
- Cloud
- Microsoft 365
- Google Workspace
- Other
- Autotask
- ConnectWise PSA
- HaloPSA
- Okta
- Duo
- Salesforce
- ServiceNow
- Zendesk
Notes
Why contain threats
Field Effect MDR is classified as Contain threats because official help material documents Active Response actions such as host isolation, malicious-domain blocking, process termination and cloud account locking. The action level still depends on the buyer's selected policy.
Package boundary
Field Effect separates mEDR, MDR Core and MDR Complete. Core is aimed at smaller endpoint and cloud environments, while Complete adds network monitoring, more cloud-app coverage, longer log-retention options and enhanced analyst support.
MSP buying context
The service is built heavily for MSPs, with partner portal, license-management and PSA integration workflows. MSP buyers should confirm whether Field Effect contacts the end customer directly during urgent response and how ARO ownership maps into their own ticketing process.
Pricing boundary
Field Effect publishes a per-user quote model, not public dollar rates. Public review sites describe mixed cost perception, so buyers should compare the quoted package against the number of protected users, included data sources and optional upgrades.